Cloud Information Security Fundamentals: CIA Triad and Core Principles

What is Cloud Security? (In Simple Words)

When you save photos, college documents, or bank credentials in the cloud, you are trusting a third-party server connected to the global internet.

Cloud Information Security is the complete collection of policies, technologies, access controls, and encryption techniques designed to protect cloud data, applications, and virtual infrastructure from cyber attacks, theft, unauthorized access, and accidental deletion.

1. The Foundation: The CIA Triad

Every security system in computer science is built upon three fundamental pillars known as the CIA Triad:

The CIA Security Triad

🔒 Confidentiality

Only authorized people can read the data; secret data stays secret

🛡️ Integrity

Data cannot be modified, deleted, or tampered with by unauthorized users

⚡ Availability

Services and data are always accessible to legitimate users when needed

1. Confidentiality

In Simple Words: Only the right person with the correct password or key should be able to see the data.
How Cloud Protects It: Data encryption (AES-256), strong passwords, Multi-Factor Authentication (MFA / OTP), and strict Access Control Lists (ACLs).
Violation Example: A hacker steals a database of student phone numbers and leaks it online.

2. Integrity

In Simple Words: The data received must be 100% identical to the data sent. Nobody should secretly alter the data while it is in transit or in storage.
How Cloud Protects It: Digital signatures, cryptographic hash functions (SHA-256), and file checksums.
Violation Example: A hacker intercepts an online banking transaction and changes the recipient account number from your college fee account to the hacker’s personal account.

3. Availability

In Simple Words: The website and database must be online and working whenever a student or customer needs them.
How Cloud Protects It: Redundant servers, automated data backups, load balancers, and Anti-DDoS protection (e.g., AWS Shield).
Violation Example: A Distributed Denial of Service (DDoS) attack overwhelms a university result portal, causing the server to crash so no student can view results.

2. The AAA Framework (Authentication, Authorization, Accounting)

To enforce security in cloud applications, the AAA Framework is used:

Authentication (Who are you?): Verifying the user’s identity via username, password, biometrics, or SMS OTP.
Authorization (What are you allowed to do?): Checking permissions. A student can only view their own marks, while a teacher can edit marks.
Accounting / Auditing (What did you do?): Keeping an unalterable log of every login time, IP address, and file modified (e.g., AWS CloudTrail).

3. Non-Repudiation

Non-Repudiation means that a sender cannot deny having sent a message, and a receiver cannot deny having received it.

In cloud transactions, digital signatures and cryptographic timestamps ensure that if an employee approves a ₹1,00,000 cloud payment, they cannot later claim: “I didn’t click that button.”

💡 DAVV Exam Tip

Question (5 Marks): “Explain the CIA Triad in the context of Cloud Computing with suitable examples.”

Define Confidentiality, Integrity, and Availability in simple terms.

Give 1 cloud security example for each (Encryption for Confidentiality, Hashing for Integrity, Redundant servers for Availability).

Draw the 3-pillar CIA diagram.

Cloud Information Security: CIA Triad & Three States of Data